Vulnerability in Apache Ambari
CVE-2016-6807
Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process…
EPSS: 0.024 (82.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Ambari — versions 2.4.0, 2.4.1
- Apache Software Foundation Ambari — versions 2.4.x before 2.4.2
Weakness classification (CWE)
References
- security@apache.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security@apache.org (x_refsource_CONFIRM, Release Notes, Vendor Advisory)
Frequently asked questions
- What is CVE-2016-6807?
- CVE-2016-6807 is a critical-severity vulnerability in Apache Ambari, classified under Improper Access Control. CVSS score: 9.8/10. Published 2017-03-28.
- How severe is CVE-2016-6807?
- Critical severity. CVSS v3 base score is 9.8 out of 10.